Shopper CVE-2026-47742

The attacker must hold a valid authenticated session in the Shopper admin panel (PR:L per CVSS - any role qualifies, including minimally trusted roles). No special server-side configuration is required - the missing authorization exists in the default installation of Shopper prior to 2.8.0 across all affected Livewire sub-form components. Exploiting the cross-product targeting component additionally requires the ability to intercept and modify Livewire AJAX requests, which is achievable with standard browser developer tools (Network tab) or any HTTP interception proxy without elevated system access. Unauthenticated attackers cannot exploit this vulnerability - a valid panel login credential is a hard prerequisite. Exploitation is scoped to Shopper instances running versions prior to 2.8.0; patched instances are not affected.

CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N describes a network-reachable, low-complexity attack requiring only low-privilege authentication (any valid panel login), with high integrity impact and no confidentiality or availability impact. The real-world risk exceeds the medium CVSS score in multi-role deployments: any panel user - including customer support agents, catalog viewers, or other minimally trusted accounts - can silently alter product pricing and inventory for any product in the catalog, potentially enabling fraud (discounting items to $0), disrupting operations (zeroing stock), or poisoning SEO/shipping data. The cross-product tamperability via unlocked productId property further amplifies the blast radius beyond what the CVSS scope:unchanged designation implies operationally. No EPSS data was provided, so exploitation probability is inferred from CVSS signals only. The vulnerability is not listed in CISA KEV, and no standalone weaponized POC has been published - risk is therefore assessed as meaningful but not imminently mass-exploited. The low attack complexity and absence of user interaction requirements mean exploitation is trivially achievable by any authenticated panel user with access to browser developer tools.

An authenticated Shopper panel user with a low-privilege role such as customer support opens the product editor for any product, then uses browser developer tools or an HTTP proxy to intercept the outbound Livewire AJAX wire request. The attacker replaces the productId property value with the ID of a different (arbitrary) product and modifies pricing or inventory fields, then resubmits the tampered wire payload to the server's Livewire endpoint. The server, lacking authorization checks on store(), persists the modified data for the targeted product without verifying the user holds edit_products permission.